Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
27-05-2024 02:56
General
-
Target
1b5f82b7a79ee91f859e5408d4117d90_NeikiAnalytics.exe
-
Size
448KB
-
MD5
1b5f82b7a79ee91f859e5408d4117d90
-
SHA1
f19f56bbf935b3e46ba5b99d0de0be393d148338
-
SHA256
e40bf60a9520e2940a3e6693206cd4c7ddb5649480b16dc7e1ff681dc7e9c8c1
-
SHA512
a3bfadf077447335d7c200d8bafc8373e7bb19110fdeb83836b22a37478edf2c199183eb7282b2abb99190280c7cde231fd291d67c0a98540f254b31cc2055a8
-
SSDEEP
6144:h1L2RGQdO798szclBqckEjiPISUOgW9X+hOGzC/NM:h1fQd3vr1kmZzcukG2/
Score
10/10
Malware Config
Signatures
-
Malware Dropper & Backdoor - Berbew 19 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Drops file in System32 directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b5f82b7a79ee91f859e5408d4117d90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1b5f82b7a79ee91f859e5408d4117d90_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DWEKYSG.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\DWEKYSG.exeC:\windows\system32\DWEKYSG.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OPHVYZ.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\OPHVYZ.exeC:\windows\system32\OPHVYZ.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XIYJP.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\system\XIYJP.exeC:\windows\system\XIYJP.exe7⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YLBN.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\YLBN.exeC:\windows\system32\YLBN.exe9⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JDRYDGV.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\JDRYDGV.exeC:\windows\JDRYDGV.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OEB.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\system\OEB.exeC:\windows\system\OEB.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BBNEAH.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\BBNEAH.exeC:\windows\BBNEAH.exe15⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKBBNY.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\BKBBNY.exeC:\windows\BKBBNY.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UXN.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\system\UXN.exeC:\windows\system\UXN.exe19⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WVS.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\WVS.exeC:\windows\system32\WVS.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MIRTUM.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\system\MIRTUM.exeC:\windows\system\MIRTUM.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UOWZFK.exe.bat" "24⤵
-
C:\windows\SysWOW64\UOWZFK.exeC:\windows\system32\UOWZFK.exe25⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJIALH.exe.bat" "26⤵
-
C:\windows\SysWOW64\AJIALH.exeC:\windows\system32\AJIALH.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DRRPSBD.exe.bat" "28⤵
-
C:\windows\system\DRRPSBD.exeC:\windows\system\DRRPSBD.exe29⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFIWM.exe.bat" "30⤵
-
C:\windows\system\TFIWM.exeC:\windows\system\TFIWM.exe31⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XIG.exe.bat" "32⤵
-
C:\windows\SysWOW64\XIG.exeC:\windows\system32\XIG.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGTDBM.exe.bat" "34⤵
-
C:\windows\system\ZGTDBM.exeC:\windows\system\ZGTDBM.exe35⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RDLQ.exe.bat" "36⤵
-
C:\windows\system\RDLQ.exeC:\windows\system\RDLQ.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZRYW.exe.bat" "38⤵
-
C:\windows\ZRYW.exeC:\windows\ZRYW.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UEDGEN.exe.bat" "40⤵
-
C:\windows\SysWOW64\UEDGEN.exeC:\windows\system32\UEDGEN.exe41⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BUEF.exe.bat" "42⤵
-
C:\windows\SysWOW64\BUEF.exeC:\windows\system32\BUEF.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JAI.exe.bat" "44⤵
-
C:\windows\SysWOW64\JAI.exeC:\windows\system32\JAI.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DSYXFAW.exe.bat" "46⤵
-
C:\windows\system\DSYXFAW.exeC:\windows\system\DSYXFAW.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATA.exe.bat" "48⤵
-
C:\windows\system\ATA.exeC:\windows\system\ATA.exe49⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJOHV.exe.bat" "50⤵
-
C:\windows\SysWOW64\LJOHV.exeC:\windows\system32\LJOHV.exe51⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ICQJ.exe.bat" "52⤵
-
C:\windows\system\ICQJ.exeC:\windows\system\ICQJ.exe53⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZWE.exe.bat" "54⤵
-
C:\windows\SysWOW64\KZWE.exeC:\windows\system32\KZWE.exe55⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SNI.exe.bat" "56⤵
-
C:\windows\SysWOW64\SNI.exeC:\windows\system32\SNI.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XFSNDDP.exe.bat" "58⤵
-
C:\windows\XFSNDDP.exeC:\windows\XFSNDDP.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLQK.exe.bat" "60⤵
-
C:\windows\system\MLQK.exeC:\windows\system\MLQK.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UYDQ.exe.bat" "62⤵
-
C:\windows\system\UYDQ.exeC:\windows\system\UYDQ.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CTTM.exe.bat" "64⤵
-
C:\windows\SysWOW64\CTTM.exeC:\windows\system32\CTTM.exe65⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GJZMVNL.exe.bat" "66⤵
-
C:\windows\system\GJZMVNL.exeC:\windows\system\GJZMVNL.exe67⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZAMC.exe.bat" "68⤵
-
C:\windows\system\WZAMC.exeC:\windows\system\WZAMC.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SAKO.exe.bat" "70⤵
-
C:\windows\SAKO.exeC:\windows\SAKO.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NNPXQE.exe.bat" "72⤵
-
C:\windows\SysWOW64\NNPXQE.exeC:\windows\system32\NNPXQE.exe73⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EOVDDV.exe.bat" "74⤵
-
C:\windows\system\EOVDDV.exeC:\windows\system\EOVDDV.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SYMTRY.exe.bat" "76⤵
-
C:\windows\SysWOW64\SYMTRY.exeC:\windows\system32\SYMTRY.exe77⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LMLZW.exe.bat" "78⤵
-
C:\windows\LMLZW.exeC:\windows\LMLZW.exe79⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AHC.exe.bat" "80⤵
-
C:\windows\AHC.exeC:\windows\AHC.exe81⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZAFUQBP.exe.bat" "82⤵
-
C:\windows\ZAFUQBP.exeC:\windows\ZAFUQBP.exe83⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSHWCF.exe.bat" "84⤵
-
C:\windows\SysWOW64\WSHWCF.exeC:\windows\system32\WSHWCF.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PLWHLX.exe.bat" "86⤵
-
C:\windows\SysWOW64\PLWHLX.exeC:\windows\system32\PLWHLX.exe87⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOA.exe.bat" "88⤵
-
C:\windows\IOA.exeC:\windows\IOA.exe89⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QBNRBUD.exe.bat" "90⤵
-
C:\windows\QBNRBUD.exeC:\windows\QBNRBUD.exe91⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AZSMICL.exe.bat" "92⤵
-
C:\windows\system\AZSMICL.exeC:\windows\system\AZSMICL.exe93⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YKVURI.exe.bat" "94⤵
-
C:\windows\SysWOW64\YKVURI.exeC:\windows\system32\YKVURI.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GPIIC.exe.bat" "96⤵
-
C:\windows\GPIIC.exeC:\windows\GPIIC.exe97⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZSMEHXF.exe.bat" "98⤵
-
C:\windows\system\ZSMEHXF.exeC:\windows\system\ZSMEHXF.exe99⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CGD.exe.bat" "100⤵
-
C:\windows\SysWOW64\CGD.exeC:\windows\system32\CGD.exe101⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LOFT.exe.bat" "102⤵
-
C:\windows\system\LOFT.exeC:\windows\system\LOFT.exe103⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KZI.exe.bat" "104⤵
-
C:\windows\system\KZI.exeC:\windows\system\KZI.exe105⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OHOJZU.exe.bat" "106⤵
-
C:\windows\system\OHOJZU.exeC:\windows\system\OHOJZU.exe107⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HHEUIN.exe.bat" "108⤵
-
C:\windows\system\HHEUIN.exeC:\windows\system\HHEUIN.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HNEIKA.exe.bat" "110⤵
-
C:\windows\system\HNEIKA.exeC:\windows\system\HNEIKA.exe111⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLKCZI.exe.bat" "112⤵
-
C:\windows\system\RLKCZI.exeC:\windows\system\RLKCZI.exe113⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NQCSP.exe.bat" "114⤵
-
C:\windows\NQCSP.exeC:\windows\NQCSP.exe115⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HEBQV.exe.bat" "116⤵
-
C:\windows\SysWOW64\HEBQV.exeC:\windows\system32\HEBQV.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CRGZXFG.exe.bat" "118⤵
-
C:\windows\SysWOW64\CRGZXFG.exeC:\windows\system32\CRGZXFG.exe119⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VJVKOGO.exe.bat" "120⤵
-
C:\windows\VJVKOGO.exeC:\windows\VJVKOGO.exe121⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UUYA.exe.bat" "122⤵
-
C:\windows\UUYA.exeC:\windows\UUYA.exe123⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KNB.exe.bat" "124⤵
-
C:\windows\KNB.exeC:\windows\KNB.exe125⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PTTF.exe.bat" "126⤵
-
C:\windows\system\PTTF.exeC:\windows\system\PTTF.exe127⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CQTRYGC.exe.bat" "128⤵
-
C:\windows\system\CQTRYGC.exeC:\windows\system\CQTRYGC.exe129⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DTXN.exe.bat" "130⤵
-
C:\windows\SysWOW64\DTXN.exeC:\windows\system32\DTXN.exe131⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWNL.exe.bat" "132⤵
-
C:\windows\system\QWNL.exeC:\windows\system\QWNL.exe133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WRZE.exe.bat" "134⤵
-
C:\windows\WRZE.exeC:\windows\WRZE.exe135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XUC.exe.bat" "136⤵
-
C:\windows\XUC.exeC:\windows\XUC.exe137⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\INKTUN.exe.bat" "138⤵
-
C:\windows\SysWOW64\INKTUN.exeC:\windows\system32\INKTUN.exe139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YDLS.exe.bat" "140⤵
-
C:\windows\SysWOW64\YDLS.exeC:\windows\system32\YDLS.exe141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GRYZ.exe.bat" "142⤵
-
C:\windows\GRYZ.exeC:\windows\GRYZ.exe143⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QOD.exe.bat" "144⤵
-
C:\windows\QOD.exeC:\windows\QOD.exe145⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FER.exe.bat" "146⤵
-
C:\windows\SysWOW64\FER.exeC:\windows\system32\FER.exe147⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GZUHOMR.exe.bat" "148⤵
-
C:\windows\SysWOW64\GZUHOMR.exeC:\windows\system32\GZUHOMR.exe149⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MVGAUAZ.exe.bat" "150⤵
-
C:\windows\system\MVGAUAZ.exeC:\windows\system\MVGAUAZ.exe151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZFWYI.exe.bat" "152⤵
-
C:\windows\system\ZFWYI.exeC:\windows\system\ZFWYI.exe153⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HTBFT.exe.bat" "154⤵
-
C:\windows\SysWOW64\HTBFT.exeC:\windows\system32\HTBFT.exe155⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOF.exe.bat" "156⤵
-
C:\windows\system\IOF.exeC:\windows\system\IOF.exe157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BGU.exe.bat" "158⤵
-
C:\windows\system\BGU.exeC:\windows\system\BGU.exe159⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YHW.exe.bat" "160⤵
-
C:\windows\YHW.exeC:\windows\YHW.exe161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUBF.exe.bat" "162⤵
-
C:\windows\SysWOW64\SUBF.exeC:\windows\system32\SUBF.exe163⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LXFBJU.exe.bat" "164⤵
-
C:\windows\system\LXFBJU.exeC:\windows\system\LXFBJU.exe165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EQUUSV.exe.bat" "166⤵
-
C:\windows\system\EQUUSV.exeC:\windows\system\EQUUSV.exe167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UGVLZ.exe.bat" "168⤵
-
C:\windows\SysWOW64\UGVLZ.exeC:\windows\system32\UGVLZ.exe169⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SRYB.exe.bat" "170⤵
-
C:\windows\system\SRYB.exeC:\windows\system\SRYB.exe171⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GBOAWZV.exe.bat" "172⤵
-
C:\windows\GBOAWZV.exeC:\windows\GBOAWZV.exe173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZUWLFAD.exe.bat" "174⤵
-
C:\windows\system\ZUWLFAD.exeC:\windows\system\ZUWLFAD.exe175⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YNHBOG.exe.bat" "176⤵
-
C:\windows\SysWOW64\YNHBOG.exeC:\windows\system32\YNHBOG.exe177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FDISVCO.exe.bat" "178⤵
-
C:\windows\SysWOW64\FDISVCO.exeC:\windows\system32\FDISVCO.exe179⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YVXDEDE.exe.bat" "180⤵
-
C:\windows\system\YVXDEDE.exeC:\windows\system\YVXDEDE.exe181⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SOEOVWM.exe.bat" "182⤵
-
C:\windows\SysWOW64\SOEOVWM.exeC:\windows\system32\SOEOVWM.exe183⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QJE.exe.bat" "184⤵
-
C:\windows\SysWOW64\QJE.exeC:\windows\system32\QJE.exe185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AHJ.exe.bat" "186⤵
-
C:\windows\AHJ.exeC:\windows\AHJ.exe187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IMWYSFG.exe.bat" "188⤵
-
C:\windows\system\IMWYSFG.exeC:\windows\system\IMWYSFG.exe189⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IPAU.exe.bat" "190⤵
-
C:\windows\SysWOW64\IPAU.exeC:\windows\system32\IPAU.exe191⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BLD.exe.bat" "192⤵
-
C:\windows\BLD.exeC:\windows\BLD.exe193⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ULT.exe.bat" "194⤵
-
C:\windows\ULT.exeC:\windows\ULT.exe195⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VOJW.exe.bat" "196⤵
-
C:\windows\SysWOW64\VOJW.exeC:\windows\system32\VOJW.exe197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GHEPJ.exe.bat" "198⤵
-
C:\windows\GHEPJ.exeC:\windows\GHEPJ.exe199⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WXNOQY.exe.bat" "200⤵
-
C:\windows\system\WXNOQY.exeC:\windows\system\WXNOQY.exe201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QKS.exe.bat" "202⤵
-
C:\windows\QKS.exeC:\windows\QKS.exe203⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DNA.exe.bat" "204⤵
-
C:\windows\SysWOW64\DNA.exeC:\windows\system32\DNA.exe205⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZSNAAG.exe.bat" "206⤵
-
C:\windows\ZSNAAG.exeC:\windows\ZSNAAG.exe207⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DBHI.exe.bat" "208⤵
-
C:\windows\system\DBHI.exeC:\windows\system\DBHI.exe209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TTS.exe.bat" "210⤵
-
C:\windows\system\TTS.exeC:\windows\system\TTS.exe211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WHXIW.exe.bat" "212⤵
-
C:\windows\system\WHXIW.exeC:\windows\system\WHXIW.exe213⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YECC.exe.bat" "214⤵
-
C:\windows\system\YECC.exeC:\windows\system\YECC.exe215⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKPJ.exe.bat" "216⤵
-
C:\windows\system\GKPJ.exeC:\windows\system\GKPJ.exe217⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QIUDVI.exe.bat" "218⤵
-
C:\windows\SysWOW64\QIUDVI.exeC:\windows\system32\QIUDVI.exe219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DSDU.exe.bat" "220⤵
-
C:\windows\system\DSDU.exeC:\windows\system\DSDU.exe221⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RQLFL.exe.bat" "222⤵
-
C:\windows\SysWOW64\RQLFL.exeC:\windows\system32\RQLFL.exe223⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZEQMW.exe.bat" "224⤵
-
C:\windows\ZEQMW.exeC:\windows\ZEQMW.exe225⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NZBN.exe.bat" "226⤵
-
C:\windows\NZBN.exeC:\windows\NZBN.exe227⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PXHH.exe.bat" "228⤵
-
C:\windows\system\PXHH.exeC:\windows\system\PXHH.exe229⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JKMRBA.exe.bat" "230⤵
-
C:\windows\JKMRBA.exeC:\windows\JKMRBA.exe231⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YFXKH.exe.bat" "232⤵
-
C:\windows\YFXKH.exeC:\windows\YFXKH.exe233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NAH.exe.bat" "234⤵
-
C:\windows\NAH.exeC:\windows\NAH.exe235⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PYU.exe.bat" "236⤵
-
C:\windows\system\PYU.exeC:\windows\system\PYU.exe237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CWUUJV.exe.bat" "238⤵
-
C:\windows\CWUUJV.exeC:\windows\CWUUJV.exe239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IWCISX.exe.bat" "240⤵